The Terrorism Backstop That Has Never Paid a Claim

After the September 11 attacks caused roughly $59 billion in insured losses, in 2024-adjusted dollars, private insurers stopped writing terrorism coverage almost overnight.▸ Congress answered in November 2002 with the Terrorism Risk Insurance Act (TRIA), which requires the federal government to share the losses from a certified act of terrorism with the insurance industry, up to a statutory ceiling. The program — TRIP — has been quietly reauthorized four times since. It has also never paid a single claim: according to Congressional Research Service testimony to the House Financial Services Subcommittee on September 17, 2025, "no attack has been certified under the act, and no federal payments have been made from the program."

The mechanics are layered.▸ First, the Secretary of the Treasury must certify that an incident is an act of terrorism. Then industry-wide insured losses have to clear the Program Trigger — $200 million in calendar year 2023, holding through the program's current expiration in 2027. Each individual insurer must also clear its own deductible, set at 20 percent of that insurer's prior-year premium in TRIP-eligible lines, before it can collect a dollar from Washington. Above the deductible, the federal share of compensation was 80 percent of the insurer's losses in 2023, with the insurer keeping the remaining 20 percent as coshare. Over it all sits the Program Cap: neither insurers nor the federal government are on the hook for aggregate losses above $100 billion in a calendar year. If Treasury does pay out, it is required to claw back some or all of it afterward through policyholder surcharges — a recoupment mechanism sized to the Insurance Marketplace Aggregate Retention Amount, which grew from $40.9 billion in 2020 to $48.5 billion in 2024 as the underlying insurance market grew.

Of the $3.27 billion insurers charged specifically for terrorism coverage in 2023, workers' compensation policies accounted for $1.04 billion — 31.7 percent, the largest of any TRIP-eligible line.▸ That is not because employers are unusually eager to buy terrorism protection. It is because all U.S. jurisdictions require that terrorism risk coverage be included in every workers' compensation policy, giving that line a 100 percent take-up rate — no employer, and no insurer, gets to opt out. Every other line has to be sold: commercial multi-peril policies, the package products favored by small and mid-sized businesses, carried terrorism coverage on about 90 percent of eligible premium in the 2023 data call; broader commercial lines ranged from 59 to 76 percent. Workers' comp skips that market test entirely, by statute.

Zoom out from terrorism premium alone and workers' compensation is still the second-largest line in the $254.8 billion commercial insurance market that TRIP's backstop reaches — $62.3 billion in premium, 24 percent of the total, behind only the broad "Other Liability" category.▸ It is also, per GAO testimony to the House Financial Services Subcommittee on September 23, 2025, one of the two categories of insurer — alongside small carriers — that stakeholders say are "most affected by changes to the program trigger," precisely because a workers' comp insurer cannot manage its terrorism exposure the way other lines can: it cannot decline to write the coverage, exclude it, or price a policyholder out of buying it.

TRIA has been extended four times — through 2007, 2014, 2020, and now through December 31, 2027.▸ Every reauthorization so far has shifted more of the risk onto private insurers: the individual deductible rose from 7 percent of premium in 2003 to 20 percent by 2020, and the industry-wide retention layer has climbed every year since. GAO's 2025 testimony found that further changes could cut the other way, threatening affordability — and flagged one gap regulators still haven't closed: cyberattacks. Treasury clarified in 2021 that TRIP can, in principle, cover terrorism losses on cyber policies, but a cyberattack has to be "violent or dangerous to human life, property, or infrastructure" and aimed at coercing U.S. policy to qualify — a bar ransomware and most cyberattacks don't clear. The Cybersecurity and Infrastructure Security Agency and Treasury's own Federal Insurance Office have not completed a joint assessment of whether cyber risk needs its own federal backstop; GAO recommendations to do so, first issued in 2022, remained open as of May 2025.

Dollar figures for premium and market size cover the 2023 TRIP data call as reported in Treasury's June 2024 effectiveness report; minor discrepancies between category sums and stated totals reflect independent rounding in the source tables. The 146.3 million covered-jobs figure is a national estimate for calendar year 2022, the most recent year in NASI's dataset.